A PDF lands on your desk as part of a legal discovery response. The document properties panel is empty. The author, creation date, and modification history fields have been deliberately or incidentally stripped. You need to establish when this document was created and by whom. The metadata that normally answers these questions is gone, but the PDF may still contain recoverable evidence of its origin.
PDF Metadata stripping is common when documents pass through sanitization tools designed to remove potentially sensitive information before sharing. These tools delete the document information dictionary, the standard metadata fields, and often the XMP metadata stream. The visible page content is preserved. The documentary context is removed.
Where Metadata Can Hide After Stripping
The document information dictionary, where Author, Title, Subject, Keywords, Creator, Producer, CreationDate, and ModDate are stored, is the primary target of metadata stripping. After stripping, these fields return empty or default values when queried.
XMP metadata, stored in a separate stream within the PDF, is often missed by basic metadata strippers that only target the information dictionary. XMP can contain the same fields plus custom properties. A Repair PDF inspection tool that examines the full file structure can reveal XMP metadata that survived stripping.
Page-level metadata, including the original page dimensions, the software that generated each page, and modification timestamps embedded in page content streams, is rarely stripped because stripping tools do not inspect page content for metadata-like data.
Technical Methods for Recovering Stripped Metadata
Examine the PDF file in a text editor that can handle binary files. Search for Creator and Producer strings in the file header and in individual object streams. These strings identify the software that originally created the PDF and the software that last modified it. The strings persist even when the document information dictionary has been emptied.
Inspect the embedded font metadata. Fonts embedded in the PDF retain their own metadata, including font creation dates and the software used to create or modify the font files. These dates provide a terminus post quem, the document cannot have been created before its embedded fonts existed.
WukongPDF provides PDF Version Control inspection through the browser that can examine document properties and identify recoverable metadata elements within the file structure.
What Metadata Recovery Can and Cannot Reveal
Recoverable metadata can identify the creating software, the operating system, and often the creation date range. A PDF created by Microsoft Word 2016 on Windows 10 in the summer of 2023 narrows the origin significantly. Recoverable metadata cannot identify the specific user who created the document or the specific computer it was created on unless that information was stored in custom metadata fields.
Modification history is harder to recover than creation information. Each save operation by some PDF editors writes a new modification date but does not retain the previous dates. The modification history that can be recovered is the history of saves by editors that preserved incremental save information.
Preventing Metadata Loss in Future Documents
Before sharing PDFs externally, review the metadata to determine whether it should be preserved or stripped. Stripping all metadata removes documentary context that may be needed later. Preserving metadata shares information that may be confidential. The decision should be deliberate.
Maintain a document register outside the PDF that records creation dates, authors, and version history for important documents. The external register is not affected by PDF metadata operations and provides an independent record of documentary provenance.
The PDF file system metadata, the creation and modification dates stored by the operating system on the file itself, are independent of the PDF internal metadata. Even when the PDF internal creation date has been stripped, the file system may still record when the file was first saved to its current storage location.
Email attachments retain the email date in the email system metadata. If the PDF was received as an email attachment, the email date provides a latest possible creation date for the document. The PDF cannot have been created after it was emailed.
Document management systems that track document history independently of the file metadata may have recorded the original creation date, author, and modification events before the metadata was stripped. Searching the document management system for the document ID or filename can recover the pre-stripping metadata.
The PDF incremental save structure, if the file was saved incrementally rather than fully rewritten, preserves previous versions of the document information dictionary. A forensic examination of the incremental save data can reveal metadata values that were present in earlier versions but overwritten in the current version.
The fonts embedded in the PDF carry their own creation and modification dates in the font file metadata. These dates are not affected by PDF metadata stripping. The most recent font date provides a lower bound for the document creation date.
Images embedded in the PDF carry EXIF metadata from the original image files, including capture dates, camera information, and software used for editing. EXIF data embedded in PDF images is not affected by PDF metadata stripping operations.
Recovered metadata should be documented with the recovery method and a confidence assessment. Metadata recovered from file system timestamps has lower confidence than metadata recovered from embedded font creation dates. The documentation allows future users to evaluate the reliability of the recovered information.
Metadata recovery from a stripped PDF is a forensic exercise that combines technical examination of the file structure with contextual research about the document origin, and the recovered information is typically partial rather than complete.
The decision to strip metadata from a PDF before sharing should be made with awareness that the stripped information may be needed later and that recovery options are limited and uncertain.
Metadata recovery from a stripped PDF combines technical analysis with contextual research to reconstruct the document origin story.
File system timestamps on the PDF file itself are independent of the internal PDF metadata.
Recovering metadata from a stripped PDF requires examining both the file structure and external sources.
Metadata recovery is an investigative process that combines technical and contextual analysis.
The PDF producer field in the document information dictionary identifies the software that created the file, information that survives most metadata stripping.
Examination of the raw PDF file with a hex editor can reveal metadata fragments that the document information dictionary no longer references.
The creation date embedded in font files within the PDF provides a terminus post quem for the document creation.
XMP metadata streams in the PDF are separate from the document information dictionary and may survive stripping if the tool targeted only the dictionary.
The modification history of a PDF can sometimes be reconstructed from the incremental save sections that accumulate with each edit.
Image EXIF data embedded in the PDF preserves the original image capture dates regardless of PDF metadata operations.
Document management system logs may record the original metadata values before the PDF was processed for distribution.
Email headers from the message that delivered the PDF can provide a latest possible creation date for the document.
The page count and page dimensions can help identify the creating software, as different applications have different default page sizes.
The PDF version number, 1.4, 1.7, 2.0, indicates which specification features were available when the document was created.
Cross-reference table analysis can reveal the sequence in which objects were added to the file, providing a relative chronology.
Object numbering in the PDF is sequential, and lower-numbered objects were typically created before higher-numbered ones.
The document language setting in the PDF catalog may indicate the original author language and locale.
Custom metadata fields defined by the creating organization may use naming conventions that identify the document source.
The PDF output intent, if present, identifies the target printing condition and can indicate the document intended use.
Embedded color profiles provide information about the color management environment in which the document was created.
The page layout initial view settings can indicate whether the document was designed for screen or print viewing.
Annotations and comments in the PDF carry their own creation dates and author information in the annotation properties.
Form fields in interactive PDFs may contain default values or JavaScript that reference organizational systems or dates.
The document title displayed in the PDF viewer title bar may be set differently from the metadata title field.
Bookmarks and the document outline preserve the section structure even when metadata is stripped.
Hyperlinks in the document may reference URLs that contain date information or organizational identifiers.
The list of fonts used in the document is recoverable from the page content streams and can indicate the creating software.
Page labels, the logical page numbers displayed in the PDF viewer, may differ from physical page numbers and reveal document structure.
Watermark text embedded in the page content may contain date or author information that was applied during document creation.
The document checksum or hash can be compared against known files to identify the original source.
File size patterns, large images, many fonts, complex vector graphics, can indicate the document type and creating software.
The presence of specific PDF features, layers, portfolios, rich media, indicates which software version was used.
Text extraction from the document can reveal header and footer text that includes dates, document IDs, or author names.
The document encryption method, if password-protected, indicates the creating software security capabilities.
Paper size and orientation metadata from each page can indicate whether the document was created in a metric or imperial measurement region.
The document creation platform, Windows, Mac, or Linux, can often be identified from the PDF producer string.
Stitching together these forensic clues can produce a reasonably complete picture of a document origin, even after deliberate metadata stripping.
The recovery of stripped metadata requires examining both the internal PDF structure and external contextual sources.
| Evidence Source | What It Reveals | Reliability | Stripping Resistance |
|---|---|---|---|
| XMP metadata stream | Author, dates, custom fields | High | Often missed by basic strippers |
| Embedded font dates | Font creation date | Medium | Very high (in font file) |
| Image EXIF data | Capture date, camera, software | Medium | Very high (in image data) |
| File system timestamps | File creation/modification | Low | N/A (external to PDF) |